CVE-2022-47767 describes a critical backdoor vulnerability in Solar-Log Gateway products, specifically affecting firmware versions v4.2.7 through v5.1.1. This flaw allows an unauthenticated remote attacker to gain super administration privileges via the web panel, impacting devices like the SL 250, 300, 1200, 2000, and SL 50 Gateway, as well as SL Base models. With a CVSS score of 9.8 (CRITICAL), the vulnerability presents a severe risk due to its network-based attack vector, low complexity, and high potential for complete compromise of confidentiality, integrity, and availability. While no active exploitation, public exploit code, or significant community discussion has been observed, patches are available in firmware v4.2.8 for some models and v5.1.2/6.0.0 for SL Base.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.2.8_117CPE matchmatch criteria | cpe:2.3:o:solar-log:solar-log_250_firmware:*:*:*:*:*:*:*:* | ||
>= 5.0.0, < 5.1.2_156CPE matchmatch criteria | cpe:2.3:o:solar-log:solar-log_250_firmware:*:*:*:*:*:*:*:* | ||
< 4.2.8_117CPE matchmatch criteria | cpe:2.3:o:solar-log:solar-log_300_firmware:*:*:*:*:*:*:*:* | ||
>= 5.0.0, < 5.1.2_156CPE matchmatch criteria | cpe:2.3:o:solar-log:solar-log_300_firmware:*:*:*:*:*:*:*:* | ||
< 4.2.8_117CPE matchmatch criteria | cpe:2.3:o:solar-log:solar-log_500_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.